Haxfix version 5.0.19

Version 5.0.19
2008 09 18

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gzipmod]

gzipmod.dll
vbagz.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.18

Version 5.018
2008 09 15

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddrawxt]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cabpck]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-

Files:
ddrawxt.dll
cabpck.dll
ddraw.sys
krnlcab.sys
braviax.exe

I changed the script that is checking for othter haxdoor and goldunfiles.
If known rootkitfiles are present, haxfix will find and delete them.


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.17

Version 5.017
2008 09 11

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMedia16"="wmedia16.exe"

%windir%\system32\wmedia16.exe
%windir%\wmedia16.exe


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.16

Version 5.016
2008 09 10

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hinet
hinet.dll
ddram.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.15

Version 5.015
2008 09 07

Added:
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\spndt.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\spndt.sys]


Fixed a bug with some of the newer goldunvariants that use the notifykey.
Sometimes this notifykey is hidden.


Added detection for these browser helper objects:
{92617934-9abc-def0-0fed-fad682644311}
{68397934-9abc-def0-0fed-fad682644311}
{61468245-A343-CF27-3452-44DF4679BDF1}
{56262124-6251-5625-3072-548536364311}
{46278903-5678-2464-3452-545679092D31}
{68363724-9ABC-DEF0-0FED-FAD682644311}
{92617934-9ABC-DEF0-0FED-FAD48C654321}
{5240864B-FDFE-4563-3514-463926792311}
{13146842-6251-5625-3072-548536364311}
{62457936-6381-6170-3572-468926792311}
{5FCA4D4F-CBDD-4263-3814-463926792311}
{65194BCE-CBDD-4263-3814-463926792311}
{BCD2AF6E-4271-6572-6429-A63F26792311}
{80523A67-ABCD-CF37-3352-54DF4479BDF1}
{4A26217C-5521-3459-2345-AB36721975AF}
{78934132-3451-67A2-8919-678931572311}
{7548953E-4371-6552-6419-A43F26792311}
{73468251-2534-8760-3685-423479197575}
{81463526-1357-4638-2418-538263794561}
{0033669F-AADD-AA59-AA7D-AA4B78888000}
{00534B55-3155-CA4F-B41D-0E922121D03C}
{92617934-9ABC-DEF0-0FED-FAD48C654321}
{00534B55-3155-CA4F-B41D-0E922121D03C}
{BF468356-BB7E-42D7-9F15-4F3B9BCFCED2}
{DABCE839-3831-3818-AF3A-3837BCD324D2}
{DABCE839-3831-3818-AF3A-47D47A738D32}
{DABFC839-F831-3D1A-A33A-A7D4BA7C8D3D}
{0000AC13-3487-1583-C4BE-BE6A839DB000}
{AE1AA4FA-C3A2-4c33-90CD-69DD021A35C8}

Haxfix deletes the clsid and the file.


Added detection for goldunvariants that use the appinitkey.
Detection is done by MD5 check: 21 different MD5's at this moment.

Matching files that are not detected by MD5 check, will be enumerated.
May I ask you to upload these file in my bleeping channel: http://www.bleepingcomputer.com/submit-malware.php?channel=11


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.14

Version 5.014
2008 08 30

Files:
berzk.dll
core3.sys
irptp.sys
meth.bin
meth.plg
powerxt.dll
spndt.sys
xatcore.dll

Notifykeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\powerxt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xatcore

Services:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\core3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\irptp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spndt

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\core3.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.13

Version 5.013
2008 08 26

Files:
windows\servicez.exe
windows\nvchost.exe
windows\winlogon.exe
system32\alog.txt
system32\crypto64.dll
system32\csrcli32.dll
system32\dpl.txt
%System%\info.txt
system32\NGIX.bin
system32\ntld.bin
system32\preved.bat
system32\ps1.dat
system32\rc.dat
system32\rdata.bin
system32\rhs.bin
system32\scrcwi32.dll
system32\sms.bat
system32\sys32time.dll
system32\winsms.bat
system32\winsms.dll
system32\cryptmd5.dll
system32\datcom.dll
system32\datmps.dll
system32\droute.dll
system32\dwave.sys
system32\dx9sr.sys
system32\emulx86.sys
system32\hdtvu6.dll
system32\hooka.sys
system32\ke64boot.dll
system32\kteproc.sys
system32\mcrwave.dll
system32\necsopp.sys
system32\nkudpn1.sys
system32\pcixm.sys
system32\pcixmm.dll
system32\pemulx86.dll
system32\routew.dll
system32\rotw.sys
system32\stfilter.dll
system32\syncm.sys
system32\syslink.dll
system32\tehlink0.dll
system32\tehlink5.sys
system32\wlite.sys

Notifykeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptmd5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\datcom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\datmps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\droute
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hdtvu6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ke64boot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcrwave
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pcixmm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pemulx86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\routew
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\stfilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\syslink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tehlink0

Services:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dwave
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx9sr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\emulx86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hooka
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kteproc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\necsopp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nkudpn1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcixm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rotr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rotw
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\syncm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tehlink5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wlite


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\kteproc.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\kteproc.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\syncm.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\syncm.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wlite.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wlite.sys

Runkeys:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nvchost"
"winlogon"
"Windows Services"
"KIT3"


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.